By Brazilian cryptocurrency exchange Mercado Bitcoin has suspended deposits and withdrawals after a security breach involving more than $46 million in suspected cryptocurrency outflows. Blockchain investigators reported that funds continued moving from addresses associated with the incident for hours after the exchange announced the suspension, raising questions about whether the attackers retained access to additional wallets.Mercado Bitcoin confirmed the incident on November 2, saying it had identified and quickly contained a security problem affecting one of its systems. The company maintained that customers suffered no losses and that no personal information was compromised.
However, blockchain security firm Hypernative initially identified more than $40 million in suspicious transfers across at least 10 networks. Subsequent tracking by Arkham Intelligence put the amount above $46 million. Mercado Bitcoin has not independently confirmed the total financial loss or disclosed which assets were held on its own balance sheet.
Why Did Funds Keep Moving After the Suspension?
CertiK senior security engineer Dickson Wu reported that the attackers initially targeted wallets across eight smaller blockchain networks, including Base, Optimism and Arbitrum, before moving to Mercado Bitcoin’s main hot wallets.
According to Wu’s preliminary analysis, the activity lasted several hours before the attackers began transferring small amounts of Ether from 27,160 different addresses. The transactions suggested that the compromised infrastructure might extend beyond the exchange’s primary operational wallets to customer deposit addresses.
The distinction matters because exchange deposit addresses can continue receiving cryptocurrency directly on public blockchains even when deposits are disabled inside the trading platform. An attacker retaining control over those addresses could potentially redirect incoming funds without needing access to customer accounts.
Investigators said the suspicious activity involved ordinary blockchain transfers rather than exploitation of a smart contract vulnerability. That transaction pattern suggests that unauthorized parties obtained the ability to initiate or approve transfers, although the precise method remains unknown.
Possible explanations include compromised private keys or transaction-signing infrastructure. Neither has been established as the cause.
Mercado Bitcoin subsequently published destination addresses across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to support asset tracing. The exchange has not provided a timetable for restoring normal services.
Investor Takeaway
Continued wallet activity raises questions about the effectiveness of the initial containment measures, particularly whether customer deposit infrastructure remained exposed.
How Much of the Stolen Crypto Can Be Recovered?
Blockchain investigators have identified cryptocurrency moving into newly created wallets and addresses associated with the incident.
A preliminary assessment at 16:42 UTC indicated that approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle. Tether separately confirmed freezing more than 4.5 million USDT connected to the breach.
Researchers also identified roughly $20 million transferred into newly created wallets, while another $20 million remained in addresses associated with the incident, including approximately 106 BTC. These figures represent preliminary snapshots rather than a final reconciliation of stolen assets.
The freezes are an important component of recovery efforts because centralized stablecoin issuers can blacklist wallet addresses, preventing affected tokens from moving. However, frozen assets are not automatically returned to their original owners, and bitcoin cannot be blocked through an equivalent issuer-controlled mechanism.
A comparable intervention followed CoinDCX’s recent $15.99 million operational loss, when Tether froze approximately $2.21 million linked to compromised wallets.
Mercado Bitcoin has not identified the attackers or disclosed how much of the suspected outflow it expects to recover.
What Does the Breach Mean for Mercado Bitcoin Customers?
The exchange’s assurance that customers have suffered no losses does not necessarily contradict reports of cryptocurrency being stolen. Exchanges can absorb losses through corporate funds while maintaining the balances owed to customers.
Nevertheless, customers currently face an operational restriction: they cannot deposit or withdraw assets while the company’s investigation continues.
Mercado Bitcoin reported serving 4.5 million users in July, when Tether announced a $20 million strategic investment supporting its expansion into tokenization, payments, credit and capital-market services.
The incident also follows the collapse of Tether-backed Chilean exchange Orionx, which initiated its shutdown after a forensic audit identified more than $7 million in missing customer assets.
Those circumstances differ from Mercado Bitcoin’s current position. The Brazilian exchange has not reported insolvency, acknowledged a customer asset shortfall or announced plans to close.
Investor Takeaway
Customer balances may remain protected, but prolonged withdrawal restrictions and unquantified exchange losses can create liquidity and counterparty concerns.
Why Is Exchange Wallet Security Under Renewed Scrutiny?
The incident comes four days after Binance suffered a $6.3 billion cryptocurrency theft on October 29, the largest publicly reported exchange hack to date.
As detailed in FinanceFeeds’ initial investigation into the Binance breach, stablecoin issuers moved to freeze substantial amounts of the stolen cryptocurrency while investigators traced assets across multiple blockchains.
Binance subsequently pledged to cover customer losses through company resources and its protection funds. Withdrawals began resuming in phases on November 1 after security reviews and infrastructure changes.
There is no evidence connecting the Binance and Mercado Bitcoin incidents or establishing that the same attackers were responsible.
For Mercado Bitcoin, the next disclosures will need to establish the final amount stolen, the extent of compromised wallet access and whether the continuing transfers involved customer deposit infrastructure. The timing of restored withdrawals will provide another measure of whether the exchange has fully secured its systems.